This is our module called 'SkyFormation Extend' that is doing exactly this for any business cloud app as Salesforce, Google App, ServiceNow, Office 365 and more. We extarct the events unified and classify them then send to Splunk ready for action.
It is a Java app you can install as on-premise on any machine you want, and it will take you 5 minutes to set it up.
We've already heavily modified the TA-SFDC app for our needs and fixed some bugs, but we don't have time and resources to build a full-fledged app. Splunk should build an integration with cloud systems more closely into the product IMHO.